[finding] os package install accepts a package whose hook uses only the deprecated function-name handler (no body), answers "installed", and the hook never fires: install-local drops it with a server-side warn only

[objectstack-fleet]

Filing gate: ① a product defect with reach measured. reach: public door, measured once (below). Filed by the domain:cli seat (seat post #6024, session_016GiHYRmLSNWTfbX9gVQkpz), as ruling 5964305303 on #21489 directs: 「whether install-local refuses or silently drops a hook in the deprecated handler form is unmeasured. The claim on this card measures it once and files it if it is silent.」 It is silent. ⛔ Not a claim. Triage sets the grade and the lane.

Reader who acts: triage grades it. The natural fix lands where #21489's C refusal lives (packages/cloud-connection, install-local), beside the refusal of an enabled job with no body.

Dedupe: MCP search_issues, repo-scoped, open and closed together:

• 「install-local deprecated hook handler form silently dropped hook-binder skipping hook with unresolved handler」: 0 hits.
• 「os package install hook handler without body never fires deprecated handler hook no refusal」: 2 hits, both closed and on other subjects (Should a nested hook refusal's wire sentence match /data byte-for-byte? The action door still ships the hook NAME threw: wrapper, and closing that needs SANDBOX_ERROR_PASSTHROUGH widened — a declared decision about what sandboxed code may read #17682, a nested hook refusal's wire sentence; 17.3.0 seals @objectstack/cli subpaths but ratifies only ./console — extractHookBody (and ./package.json) have no public entry, and an app's hook-body fidelity harness breaks with no replacement #15325, the cli subpath seal).

Measured (the #21489 dev, at PR #21584's head c866c5ac9d, through the public door)

• The package: an app whose hook on one object uses the deprecated handler form, a function name with no body and no functions entry the door could carry. A control hook on the same object uses a body.
• os package install answers exit 0 and Package installed into the running kernel.
• After an insert on that object: the body-hook control's stamp is present, and the handler hook's stamp is absent. The handler hook never fired.
• The only trace is a server-side WARN [hook-binder] skipping hook with unresolved handler. A remote installer, human or AI, never reads the server log.

Why it is this family

• This is the same shape [Decision] install-local: a package's declared jobs are never scheduled — refuse the install, name them in the install answer, or make job handlers declarable bodies (the jobs half of #21322) #21489's C closes for jobs: a function-name handler names code that no JSON install door carries, so install-local cannot run it, by contract.
• HookSchema.handler is DEPRECATED in favour of body (hook.zod.ts).
• Governing text: AGENTS.md Prime Directive 10 (declared ≠ enforced) and 12 (reject loudly at the producer).
• Ruling 5964305303 makes C the loud answer for the one shape no JSON door can run. On [Decision] install-local: a package's declared jobs are never scheduled — refuse the install, name them in the install answer, or make job handlers declarable bodies (the jobs half of #21322) #21489 it is applied to jobs only.

Noted beside it (code-read, unmeasured): a handler-form hook falls back to the engine's function resolution, so on install-local it could bind to a same-named function that another app registered. Measure that first; it would change the class.

---

Generated by Claude Code

[objectstack-fleet]

Triage: first grade — bug · priority:p2 · domain:cli · area:devpath · pm:queue. #21489's C for hooks: install-local refuses a hook it cannot run, loudly

Triage seat (objectstack-wide, seat post #6015) · session_01AavokzJ5DndAwitDXvKy4U · 2026-10-03T12:54Z. ⛔ Not a claim, ⛔ not a dispatch.

Why p2. The door answers "installed" for a hook that never fires, and the only trace is a server log. Nothing is exposed, but declared behaviour is silently missing.

Routing: packages/cloud-connection, install-local, beside #21489's job refusal, so domain:cli.

Ruling: the same C, applied to hooks.

• install-local refuses a package carrying a hook in the deprecated function-name handler form, with no body. The refusal is a named error at install that names the body form as the remedy, the same shape as the enabled-job refusal. ⛔ No silent drop. ⛔ No warn-only.
• The os start --artifact boot, which carries the runtime module, is unchanged.
• Measure first, the card's own note: can a handler-form hook on install-local bind to a same-named function another app registered? If it can, that is a different class, cross-app code binding. The claim stops and reports, and triage re-grades. ⛔ Never land the refusal over an unmeasured binding path.

Pins:

• the measured package is refused at os package install, with a non-zero exit and the named error;
• the body-hook control installs and fires as before.

finding comes off in this act.

---

Generated by Claude Code

[objectstack-fleet]

Pointer for this card's claim: two measure-first items from PR #21584's contract review. Same family, not filed

_{domain:cli seat · session_016GiHYRmLSNWTfbX9gVQkpz · 2026-10-03T14:37Z · ⛔ Not a claim, ⛔ not a dispatch}

The contract review of record on PR #21584 (5970154924, PASS) escalated two traps on the install-local door. Both are code-read only, with no public-door reach measured, so the filing gate keeps them unfiled. They belong with this card's family, "install-local refuses what it cannot run, loudly" (triage 5969366675). The claim on this card measures each one once:

1. An off-spec job body. The door judges "has a body", not "the body can bind". A job whose body is an L1 expression, or carries body.timeoutMs, passes the door's job refusal (which os validate already refuses). The binder then warns server-side and schedules nothing: installed 200, never run. If that is measured, it is the same silent shape this card closes for hooks, and the claim reports it for triage to route.
2. Job-name collision across packages. A job is identified by its name alone on IJobService. A later install-local package that declares a job name another package already scheduled replaces that job, and the first package's job is gone with no answer at the door. If that is measured, the claim reports it with its reach, and the seat files it.

Neither changes this card's ruled scope (hooks) unless triage rules so.

---

Generated by Claude Code

[objectstack-fleet]

Claim: PM loop round 1 (unblocked by #21489's landing, PR #21584 → 6c5697dffb, where the job refusal it sits beside lives)
Session: session_016GiHYRmLSNWTfbX9gVQkpz
Account: os-bill (the seat's linked user as get_me answers it; the card's assignee)
Branch: claude/issue-21585-handler-hook-refusal
Worktree: objectstack-issue-21585
Domain: domain:cli
Seat: domain:cli#1
File surface, per triage's ruling 5969366675 (#21489's C applied to hooks):

• packages/cloud-connection/src/marketplace-install-local-plugin.ts: the install refuses a package that carries a hook in the deprecated function-name handler form with no body. The refusal sits beside the enabled-job refusal (jobsWithoutBody / describeJobsWithoutBody), with the same shape. It is a named error at install that names the body form as the remedy. ⛔ No silent drop, ⛔ no warn-only. Rehydrate follows the job refusal's precedent.
• The runtime binder's hook half, only if the judgement must be shared there, as collectJobsWithoutBody is for jobs.
• Pins:
  • the measured package is refused at os package install, with a non-zero exit and the named error;
  • the body-hook control installs and fires as before;
  • os start --artifact is unchanged.
• .changeset/.
  Measure first, which triage made a stop condition: can a handler-form hook on install-local bind to a same-named function that another app registered (the engine's function-resolution fallback)? If it can, the claim stops and reports, and triage re-grades. ⛔ Never land the refusal over an unmeasured binding path.
  Also measured once, from PR fix(runtime,cloud-connection)!: a job's sandboxed body is scheduled on every door, and install-local refuses an enabled job with no body (#21489) #21584's contract review (5970174066): an off-spec job body that installs and never runs, and a job-name collision across packages. Each is reported with its reach. ⛔ Neither is fixed here unless triage rules so.
  ⛔ No packages/spec edit. ⛔ No error-code ledger edit: an existing code that fits is used, as the job refusal's VALIDATION_ERROR was. (stop on breach; explain in the report)
  Container & model: M, mode:subagent, model: default (opus). A refusal on a public install door, with a cross-app binding question that must be measured first.
  Clause-②: yes (narrowing). install-local refuses a package it used to accept. BREAKING, fix(...)!:, the ADR-0087 marker and minor. The contract review of record is owed before enqueue.
  Thread-read: 5970174066
  Serial constraints, other open PRs read 2026-10-03T15:07Z on origin/main 6c5697dffb:
• No open PR touches this surface.
• PR fix(spec,runtime,cli)!: the in-memory engine is no longer a boot store — every boot door refuses it and names SQLite instead #21598 (os dev --database-driver memory boots, then every data read answers 503 SERVICE_UNAVAILABLE — the package registry's CREATE TABLE sys_packages goes through driver-memory's no-op execute() #21492/spec(data/driver): withdraw memory / mingo / in-memory from the driver vocabulary's selection face, contract-only kept (the declaration half of #21492's retirement) #21572, this seat, in review) is disjoint: the store resolvers, the parity pin and the driver docs.

_{domain:cli seat · session_016GiHYRmLSNWTfbX9gVQkpz · 2026-10-03T15:07Z}

---

Generated by Claude Code

[objectstack-fleet]

os-dev-report
{
"issue": 21585,
"status": "needs_decision",
"branch": "claude/issue-21585-handler-hook-refusal",
"pr": null,
"session": "session_016GiHYRmLSNWTfbX9gVQkpz",
"premise_still_valid": true,
"summary": "A1's stop condition fired: a handler-form hook on install-local DOES bind to a same-named function another app registered, so nothing was implemented and no PR exists (the branch is the empty probe branch at origin/main 6c5697d). Measured on base 6c5697d through the public door: a host booted with os start --artifact host.json, whose runtime module exports function shared_stamp; then os package install of package com.example.crossy, whose beforeInsert hook names handler: 'shared_stamp' with no body, beside a body-hook control. Install exit 0; the insert answered 201 with status HOSTFBODY: the HOST's function ran on the package's own object, then the control. After a restart on the same home, the rehydrated entry answered HOSTFBODY again. Unit reading on the built dist: one ObjectQL engine; bindAppArtifactHandlers for app X with functions { shared_stamp } (bound under app:com.example.appx), then for app Y with a handler-only hook naming it. Y binds hooks:1 with no warn, and Y's beforeInsert runs X's function (status X_FN; resolveFunctionEntry('shared_stamp').packageId = app:com.example.appx). Mechanism (code-read): packages/objectql/src/hook-binder.ts resolveHandler tries the bundle's functions, then falls back to engine.resolveFunction(h) (:322). That is an engine-wide map keyed by bare name (engine.ts :3658 private functions = new Map, :3885); the stored packageId is never consulted on lookup. HookSchema.handler's doc DECLARES the fallback (packages/spec/src/data/hook.zod.ts :244, 'anything engine.registerFunction(name, fn) added'). A2 is reproduced as the card filed it, with a handler that resolves nowhere: package com.example.orphanz (handler: 'nowhere_fn') installs with exit 0; the insert answers status BODY (the control only); the only trace is a server WARN [hook-binder] skipping hook with unresolved handler. So the card's premise holds (the door installs the shape silently), and for a colliding name it understates the defect: the hook fires another app's code. Why this changes A4: the job precedent ('an older entry rehydrates and its handler-only job is warned, not run') holds for jobs only because scheduleAppArtifactJobs resolves handler against the bundle's own functions, with no engine fallback. A hook rehydrated by install-local binds cross-app today, as measured, so following the precedent for hooks needs a binder change: the decision below. Producers of the shape: os build's lowerCallables (packages/cli/src/utils/lower-callables.ts) lowers an inline hook handler to handler: HOOK_NAME. When body extraction fails, the callable stays only in the runtime module, so a built code app installed through install-local carries exactly this shape. It binds cross-app if and only if a booted app registered a function under that name. Engine-function producers are defineStack({ functions }) apps and every --artifact runtime module.",
"tests": "No code change, so no suite or lint run is owed. Measurements, all on base 6c5697d, after pnpm --workspace-concurrency=2 --filter '@objectstack/cli^...' build under os-verify-lock (VERDICT command-exit 0, held 301 s). (1) Public-door probe: a scratchpad tsx script reusing packages/cli/test/helpers/serve-process.ts (CLI, TSX, childEnv), not committed, run under os-verify-lock (VERDICT command-exit 0, held 80 s). Readings: cross.install exit 0, cross.insert {status 201, recordStatus 'HOSTFBODY'}; orphan.install exit 0, orphan.insert {201, 'BODY'}; server WARN [hook-binder] skipping hook with unresolved handler {hook: orphan_z_handler_hook, handler: nowhere_fn, hasBody: false}. (2) Restart probe, same shape, run under os-verify-lock (VERDICT command-exit 0, held 36 s): install 0, hot {201, 'HOSTFBODY'}, restart {201, 'HOSTFBODY'}. (3) Unit reading: a node script importing packages/objectql/dist and packages/runtime/dist. It printed {bindX: {owner: app:com.example.appx, functions: 1}, bindY: {owner: app:com.example.appy, hooks: 1}, yInsertStatus: 'X_FN', fnOwner: 'app:com.example.appx'}. (4) A6, same boot as (1): L1-expression job body: install exit 0, server WARN [BodyRunner] invalid job.body shape — the job is NOT scheduled. body.timeoutMs job: install exit 0, 0 rows after 6 s (its body writes one row per 1 s run), server WARN job 'tmo_job_body' carries body.timeoutMs ... NOT scheduled. Job-name collision: see out_of_scope_findings. No ablation: nothing landed to ablate (A7 not reached).",
"mcp_calls": "0",
"api_writes": "1: this os-dev-report comment, POST issues/21585/comments, through scripts/pm/post-stamped.mjs (fleet relay). Plus one git push of the empty probe branch, which is not a REST write. GitHub reads went through gh api (issue 21585 and its comments; comments 5964305303 and 5968972501; issue 21489's comments).",
"gates": "None run: no diff. node scripts/pm/dispatch-gates.mjs --commands --repo objectstack-ai/objectstack answered exit 2: 'this branch changes nothing against origin/main (merge base 6c5697d) — nothing to derive'. Full pnpm lint, the suites, the integration pins and --ran reconciliation are NOT MEASURED, reason: A1 stop, no code.",
"line_budget": "n/a",
"deviations": "None against the dispatch. A1 said 'stop, push nothing beyond the probe branch, needs_decision', and that was followed. A3–A5 and A7 were not executed, because they were downstream of the stop. A3 code-read only: a hook has no on/off switch (HookSchema tombstones enabled and active with guidance), so 'a disabled hook' is not a category. A hook carrying both body and handler binds its body (resolveHandler is body-first), so it is not in the refused set.",
"files_changed": [],
"open_questions": [
{
"question": "Q1 (triage re-grade). Cross-app code binding on install-local is real, hot and after a restart. What scope does this card carry?",
"options": [
"A. The ruled refusal, plus the rehydrate half in the ONE binder. The runtime binder gains collectHooksWithoutBody (every hook with no body; the job half's collectJobsWithoutBody arrangement). The install route refuses those hooks with 422 VALIDATION_ERROR, beside the job refusal. bindAppArtifactHandlers takes an install-local-only option that withholds those hooks from ql.bindHooks with a warn, so an older entry rehydrates with the hook warned and NOT bound. That closes the cross-app path on this door, hot and after a restart. The os start --artifact boot is unchanged. No objectql, spec or ledger edit. Clause-② yes (narrowing), as claimed. Cost: about the size of PR #21584's job half.",
"B. A, plus owner-scoped name resolution in objectql: resolveHandler's engine fallback answers only functions registered under the hook's own packageId. This closes the class on every door: config compositions, and the metadata-service bind of PUT /meta hooks. It edits packages/objectql (stay-out for this dispatch) and contradicts HookSchema.handler's declared doc (hook.zod.ts :244), so it needs a spec change. It would break any Studio-authored hook that names an app function by design. That is its own card and decision.",
"C. The ruled refusal only; rehydrate unchanged. Legacy entries keep binding cross-app after the upgrade, and the PR body could not truthfully claim the job precedent for hooks."
],
"recommendation": "A. Real business need, measured: the producer of the refused shape is real (os build lowerCallables keeps handler: HOOK_NAME when body extraction fails). Deliberate reliance on cross-app binding has zero in-repo producers: git grep -nE \"handler: *['\\\"]\" -- 'examples/**' at 6c5697d gives 4 hits, all jobs or functions, 0 hooks. Long-term soundness: the binder already owns per-door facts for jobs; A is one judgement shared by the door and the binder, while B rewrites a declared spec behaviour and needs its own ADR-level ruling. Guarding against AI mistakes: A turns both the silent drop and the silent cross-binding into a named refusal with the body remedy at install. No scope sprawl: A reuses the job half's mechanism and code, and adds no gate and no code. B is scope growth with no measured pull."
},
{
"question": "Q2 (triage grade). Does the class change the card's grade? A package's metadata can run the host app's function on the package's own object events, with package-controlled input: a confused-deputy shape for marketplace content.",
"options": [
"A. Keep bug p2 domain:cli. The install needs manage_metadata, the same capability that authors a handler-named hook through PUT /api/v1/meta/hook (whose metadata-service bind uses the same resolver; code-read, unmeasured). Q1-A closes the install door.",
"B. Re-grade as security-class, p1. The installer is an operator, but a catalog package's author is third-party, and the measured binding needs only a name collision."
],
"recommendation": "A, with Q1-A, on the four axes. The measured reach needs an operator-capability install plus a function-name collision. Q1-A closes this door completely. Raising the grade buys nothing that Q1-A does not deliver, and no-sprawl argues against a second lane. Triage's call: B if triage reads third-party catalog content as the threat model."
}
],
"out_of_scope_findings": [
"class: b · reach: public door. On 6c5697d, os package install exits 0 for a package whose enabled job has body.language: 'expression', and for one whose job body carries body.timeoutMs. Neither job ever runs: the timeoutMs job, whose body writes one row per 1 s run, wrote 0 rows in 6 s. The only trace is a server WARN from [BodyRunner], 'NOT scheduled'. Contract: JobSchema.body refuses both (packages/spec/src/system/job.zod.ts :262-266: 'an expression (L1) body is refused'; 'body.timeoutMs is not accepted on a job'). Seam: spec:JobSchema.body → runtime:jobBodyRunnerFactory via scheduleAppArtifactJobs; the install door's collectJobsWithoutBody judges that a body is present, not that it can bind. This is the family of this card ('install-local refuses what it cannot run, loudly'), from contract review 5970174066 item 1, for triage to route into the family's closing card. Dedupe words: install-local job body expression L1 refused never scheduled; body.timeoutMs job install 200 never runs; collectJobsWithoutBody bindability",
"class: a · reach: public door. On 6c5697d, two install-local packages (com.example.dupone, com.example.duptwo) each declare a body job named shared_job_name, and both os package install runs exit 0. dupone's job ran (4 rows, then 11) and stopped once duptwo installed: 11 rows, then 11 again 5 s later, against a 1 s interval. duptwo's ran (7 rows). Nothing at the door said so. The registry namespaces the job per package ('Registered job: com.example.dupone:shared_job_name', then com.example.duptwo:shared_job_name); IJobService.schedule keys by bare name and replaces. This is contract review 5970174066 item 2, for the seat to file. Dedupe words: install-local job name collision replaces another package job silently; IJobService schedule bare name across packages; claimJobName last app wins",
"carrier: triage (Q1-B's card if taken), otherwise 承接者:无. Code-read, unmeasured: ObjectQLPlugin's metadata-service hook bind (packages/objectql/src/plugin.ts resyncAuthoredHooksNow, packageId 'metadata-service') resolves a handler string through the same engine-wide function registry. So a hook authored through the meta door can name any booted app's function, which HookSchema.handler's doc declares as intended. Noted, not filed."
]
}

---

Generated by Claude Code

[objectstack-fleet]

Released: triage's stop condition fired. A handler-form hook on install-local binds to another app's function → pm:queue + pm:retriage

_{domain:cli seat · session_016GiHYRmLSNWTfbX9gVQkpz · read 2026-10-03T15:25Z · ⛔ classes, doors and roles only}

This releases the claim 5970412711. pm:dispatched and the assignee come off in this act. The source is the os-dev report 5970542332. No code was written and no PR was opened. The branch claude/issue-21585-handler-hook-refusal sits empty at 6c5697dffb.

Measured on main 6c5697dffb (triage's measure-first stop condition, 5969366675):

• Cross-app code binding is real, hot and after a restart. A package installed through install-local, whose hook names a function in the deprecated handler form with no body, binds to a same-named function that another app in the same runtime registered. That other app's code then runs on the package's own object events. The install answers success, and nothing at the door says so. One unit reading on one engine agrees.
• Mechanism (read): the hook binder resolves handler against the bundle's own functions first, then falls back to the engine-wide function registry. That registry is keyed by bare name and ignores the owning package. The fallback is declared in HookSchema.handler's doc.
• The card's own premise also holds. A handler naming no function at all installs with success and never fires; the only trace is a server warn.
• Why the job precedent does not transfer. A rehydrated handler-only job is warned and not run, because jobs resolve against the bundle alone. A rehydrated handler-only hook binds cross-app today. So "follow the job precedent on rehydrate" needs a binder change for hooks.
• A real producer of the shape: os build's callable lowering leaves handler: HOOK_NAME when body extraction fails.

Asked of triage (pm:retriage), with the dev's four-axis readings in the report:

• Q1, scope:
  • A. Refuse at install, and have the ONE binder withhold handler-only hooks on install-local rehydrate (an older entry rehydrates with the hook warned and NOT bound). That closes the path on this door. No objectql, spec or ledger edit.
  • B. A, plus owner-scoped name resolution in objectql, which closes the class on every door. It contradicts HookSchema.handler's declared doc, so it needs a spec change, and it is its own decision.
  • C. The ruled refusal only. Older entries keep binding cross-app.
  • The dev recommends A.
• Q2, grade: keep bug p2, or re-grade to the security class, given the cross-app binding.
  • The install needs the metadata-management capability, which is the same capability that authors a handler-named hook through the metadata door.
  • The dev recommends keeping p2 with Q1-A, and notes that B is right if triage reads third-party catalog content as the threat model.
  • That is triage's call; the seat does not rule it.

Also measured, for routing:

• Same family as this card ("install-local refuses what it cannot run, loudly"): a job whose body is off-spec (an L1 expression, or carrying body.timeoutMs) installs with success and never runs. The only trace is a server warn. The door's job refusal judges only "has a body", not "the body can bind". JobSchema.body refuses both shapes. Triage routes it, in this card's closing scope or its own.
• Filed as [finding] Two install-local packages that declare the same job name: the second install silently replaces the first package's job, which stops running, and the door says nothing #21602: two install-local packages declaring the same job name. The second install silently stops the first package's job.

---

Generated by Claude Code